Microsoft Office Update 16.78

TidBITS Talk
1

Early Warning Head’s Up

Just (almost) finished running MS AutoUpdate and Intego’s VirusBarrier [VB] detected 10 ‘Infected’ files with “trojan” appearing in one of the columns. (‘almost’ meaning Excel never did install after a couple of retries)

I spent some time ‘chatting’ with MS online support, who confessed they really don’t do support for macOS (whah…??? ** See Chat Log comment belo) but offered some help. She suggested restarting and then to resume our chat, with the note we’d be Repairing a volume with Disk Utility at that time

In the meantime VB was unable to ‘Repair’ them, but they do appear to be Quarantined.
I restarted and presently have VB rescanning…

  • Just thotcha might otter wanna know

Here’s what MS Support said about support:
Just to set proper expectations ,Jeff that since you are using a Mac device, it is actually the correct support for it is the apple support as we don’t have enough resources in resolving such issues due to it is not our Operating system as we mainly handle Windows Operating System and Offices

2

Thank you for the heads-up on this.
ACE - maybe it would be useful to have a new webpage that is simply a list of discussions with grievances about Microsoft products? This is turning out to be a bad year for Mac users trying to use these products!

3

They might need a separate server to handle the content

If I didn’t have so much time invested in Excel and VBA (since mid-80’s ?) I’d have moved down the road a long time ago.

4

I only have VirusBarrier Scanner (free) and MS 16.78 was already installed, but when I ran VBS against all the files in Applications, nothing was found. I would expect the signature database for VB would be the same for VBS.

Without knowing the names of the files that were detected as “infected” I can’t comment further.

5

The infected files were buried deep in the main System/Library - the attached screenshot shows the path to one of the files.

On closer inspection of the VirusBarrier Log, it appears they’re all related to Excel, which likely explains why the Excel Update failed (i.e., since VirusBarrier ‘Quarantined’ them)
… I’m fixin’ to run it up the flagpole with Intego to get their take on it

MS Office Infected Files Path 2023-10-18 at 15.22.17
MS Office Infected Files Path 2023-10-18 at 15.22.17514×558 46.2 KB

6

Thanks, but that still doesn’t tell me the name of the file.

And the fact that it was found in a cache file means that particular file isn’t harmful, but it does tell me the path within Excel where there might be such a file. Since the SharedSupport folder within Excel contains 202 files or folders, I’m no closer to know what i might be.

But since VBS didn’t find anything wrong with the Excel app, I suspect Intego has fixed it by now.

7

Sounds like you’ve got a lot of cruft hanging out there. On my system there’s now nothing beyond Macitosh HD • Library • Caches • com.microsoft.autoupdate.helper • Clones.noindex

  • I’m guessing they were temporary files used, perhaps, by MS AutoUpdate

  • I ran a Full Scan in VirusBarrier last night and it finds no infected files

You mentioned running “VBS against all the files in Applications”, and “SharedSupport folder within Excel” - note these are not in Applications - note the path in my ‘path’ screenshot above and the paths listed below

Hope this helps

Note: The • and - characters are both ‘folder’ delineators; the difference being the result of (1) taking a screen shot in VirusBarrier:Logs, and (2) using TextSnipper to copy the text

Macitosh HD - Library • Caches • com.microsoft.autoupdate.helper • Clones.noindex - Microsoft Excel.app - Contents • SharedSupport Microsoft. Mashup.Container.app - Contents • SharedSupport • zh-Hant - Microsoft. Mashup.Document.resources.dli.patched

Macitosh HD - Librarv - Caches - com.microsoft. autoupdate. helper - Clones. noindex - Microsoft Excel.app - Contents - SharedSupport • Microsoft. Mashup.Container.app - Contents • SharedSupport - es • Microsoft. Mashup. Document. resources.dll.patched

Macitosh HD - Library - Caches - com.microsoft.autoupdate.helper • Clones.noindex - Microsoft Excel.app - Contents - SharedSuport • Microsoft.Mashup.Container.app - Contents • SharedSupport - id • Microsoft.MashupEngine.resources.dil.patched

Macitosh HD - Librarv - Caches • com.microsoft.autoupdate.helper • Clones.noindex - Microsoft Excel.app • Contents • sharedsupport • Microsoft.Mashup.Container.app - Contents - SharedSupport • nl • Microsoft.Mashup.Document.resources.dil.patched

Macitosh HD • Library - Caches - com.microsoft.autoupdate. nelper - Clones.noindex - Microsoft Excel.app - Contents • Sharedsupport - Microsoft.Mashup.Container.app - Contents - SharedSupport - ar - Microsott. Mashup.Document.resources.all.patched

Macitosh HD - Library - Caches • com.microsoft.autoupdate.helper • Clones.noindex - Microsoft Excel.app - Contents - Shared Support - Microsoft. Mashup.Container.app - Contents • SharedSupport • Microsoft. Mashup.Shims.dll.patched

Macitosh HD • Library • Caches • com.microsoft.autoupdate.helper - Clones.noindex • Microsoft Excel.app - Contents • Sharedsupport • Microsoft.Mashup.Container.app - Contents • SharedSupport • Microsoft. Mashup.Web.Diagnostics.dil.patched

Macitosh HD - Library - Caches • com.microsoft.autoupdate.helper • Clones.noindex - Microsoft Excel.app - Contents - SharedSupport • Microsoft.Mashup.Container.app • Contents • SharedSupport - sv - Microsoft. Mashup.Document.resources.dil.patched

Macitosh HD • Library - Caches • com.microsoft.autoupdate. helper • Clones.noindex - Microsoft Excel.app • Contents • SharedSupport - Microsoft. Mashup.Container.app • Contents • SharedSupport • zh-Hant • Microsoft. Mashup.Client.Desktop.UI.resources.dll.patched

Macitosh HD . • Library • Caches • com.microsoft.autoupdate.helper • Clones.noindex - Microsoft Excel.app - Contents • Sharedsupport • Microsoft.Mashup.Container.app • Contents • SharedSupport • zh-Hant • Microsoft.Mashup.Document.resources.dil.patched

8

Sorry I wasn’t clear. The place where I had 202 items was in the Excel app itself, not any cached file. My Library/Caches/com.microsoft.autoupdate.helper/clones.noindex/ folder is also totally empty and I agree that it’s just for temporary files.

I can find similarly named files within /Applications/Microsoft Excel.app/Contents/SharedSupport/Microsoft.Mashup.Container.app/Contents/SharedSupport/ except with the “.patched” dropped, so as the last step in the Microsoft AutoUpdate process those files are normally copied from /Library/Caches… to /Applications/Microsoft Excel.app…, but in your case they had already been moved to VB Quarantine so the update failed.

I still have no idea why VB is doing that as the file contents in both your case and mine would be identical, only the file names are different with the “.patched” added, which is why I said it looks like Intego has already fixed the problem. Have you tried to update Excel again recently?

9

All Clear!

According to Intego tech support, VirusBarrier’s alerts are likely to have been a “false positive”
… this after several emails back and forth, reinstalling the Excel update, and sending them a log of the activities.

Since then, I’ve been running Excel 16.78 without further incident

10

I have the same version of Office and when I ran a VirusBarrier scan it didn’t find anything, so it looks like we’re okay.

11

Running the latest Office update, I left it downloading updates for the Office suite. The next morning it appeared to be stalled. Eventually I decided to click the down arrow ( V ) against the Word item. It helpfully advised me that Word could not update because the Word app was open. After I closed Word the update proceeded. Not very intuitive, but I guess that is Microsoft!
I should point out that I have autoupdate disabled and use the Word help menu to “check for updates”. Now I have to remember to close Word before proceeding with an update.